CVE-2024-5441: Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload
The Modern Events Calendar plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the setfeaturedimage function in all versions up to, and including, 7.11.0. This makes it possible for authenticated attackers, with subscriber access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The plugin allows administrators (via its settings) to extend the ability to submit events to unauthenticated users, which would allow unauthenticated attackers to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5441?
CVE-2024-5441 is considered a critical vulnerability due to its potential for arbitrary file uploads by authenticated attackers.
How do I fix CVE-2024-5441?
To fix CVE-2024-5441, update the Modern Events Calendar plugin to version 7.12.0 or later.
Which versions of the Modern Events Calendar are affected by CVE-2024-5441?
All versions of the Modern Events Calendar up to and including 7.11.0 are affected by CVE-2024-5441.
Can CVE-2024-5441 be exploited by unauthenticated users?
No, CVE-2024-5441 requires authenticated users with subscriber access to exploit the vulnerability.
What actions should I take if I cannot update due to compatibility issues?
If updating is not possible, consider temporarily disabling the Modern Events Calendar plugin until a compatibility update can be implemented.